This week’s State of the Union Address was the fourth in a
row in which President Obama highlighted the critical nature of cybersecurity. Until
the most recent onslaught of headlines painted a painful picture of the
consequences of a data breach, all too many of our organizations have been
focused on passing compliance audits and dealing with a broad variety of
threats to long-term business viability. Times have changed, and the headlines
and the tough reality are all crystal clear: the bad guys are strong,
dedicated, and working productively together, and they are in our networks today.

As President Obama said, lawmakers must “finally pass the
legislation we need to better meet the evolving threat of cyber-attacks,” and,
“If we don’t act, we’ll leave our nation and our economy vulnerable.” Recently
proposed legislation would relieve some of the risk of participating in the
information-sharing for which the federal government is asking. Defending our
organizations is becoming increasingly complicated for legal and security
teams, so it’s crucial for such legislation to increase the incentives or
decrease the exposure that companies would experience in being more transparent
and collaborative with government when data breaches occur.

Last week, the National Institute of Standards and
Technology (NIST) released an update to its Framework for Improving Critical
Infrastructure Cybersecurity, incorporating feedback from its October
workshop as well as responses to an August Request for Information. While
adoption of the Framework remains voluntary and not a regulatory requirement,
many large organizations in a variety of industries consider it to be an
effective benchmark for security operations. We at Guidance Software believe it
will soon be considered a “commercially reasonable” standard, but we also
recommend incorporating additional, proactive security practices for a more
complete security posture.

This most recent update to the Framework reports on certain
implementation issues, including the need to expand awareness among smaller and
medium-sized businesses in the critical infrastructure sector. Some concern
exists that the Implementation tier of the Framework’s three main components—Core,
Profile, and Implementation Tiers—is being used the least frequently. Instead,
the Framework is being most commonly used simply as a basis for evaluating
security—as a yardstick, if you will.

Among the aspects of the NIST Framework that I believe holds
the most promise in defending our organizations is that of information-sharing.
Many who have responded to NIST’s calls for feedback have expressed interest in
expanding this type of collaboration in order to build more powerful threat
intelligence feeds across American industries. While interest in participation
is high, so are the levels of concern about potential impact on corporate
reputation if data breaches were made public. Since the original Framework was
published, there has been a clear call for a means of reporting a breach and
related information anonymously.

To help organizations better understand the merits of the National Institute of Standards and Technology Cybersecurity Framework, Guidance Software is hosting a two-part webinar, “Implementing the Detect Function in the NIST Cybersecurity Framework.” Senior Information Technology Advisor Adam Sedgewick of NIST will be the featured presenter. The webinar will also feature a presentation by Alfred Chung, EnCase Analytics product manager for Guidance Software.

Yesterday’s release of the final NIST Cybersecurity
Framework is an immediate call to action for companies managing critical
infrastructure in the United States. With the core of the Framework having
changed very little from preliminary versions, it calls for companies in a
broad range of industries from finance and healthcare to energy and information
technology, to be prepared to adopt it and prove that their cybersecurity
practices are consistent with the outlined practices. The primary difference
from the preliminary draft is a revision to the privacy section, because critics
felt the preliminary draft of the privacy section would be so costly and
prescriptive as to deter widespread adoption of the Framework, which is, at
present, still voluntary.

The NIST
Cybersecurity Framework: “Commercially Reasonable?”

Over time, as federal incentives are offered and these
industries increasingly accept and comply with the Framework, it’s likely that
the private sector will move toward the NIST Cybersecurity model through common
law liability. Some data-privacy specialists are already speculating that the Framework
is likely to become a standard for what’s considered “commercially reasonable”
for corporations who come under regulatory scrutiny or are involved in
litigation related to a data breach.

A few days ago, I was delighted to see the National
Institute of Standards and Technology (NIST) release its Preliminary Cybersecurity
Framework for reducing cyber risks to critical infrastructure. And my first
read-through was pretty positive: they cover a lot of material, and I think it
will help organizations understand the full picture of security readiness. Their
tiered approach, for instance, is sound, and I’ve seen it work successfully in
other industries–e-discovery, for instance, has the EDRM Maturity Model, and
software development has the CMMI. And I’m very pleased to see such attention
paid to PII and privacy.

That said, however, I saw a few structural problems on my
second review. The Framework has a lot of noise about security policies and procedures
and not as much of a call-to-action on collaboration and threat
intelligence-sharing as I would like. It lacks any mention of proactive
forensics or proactive investigation. It contains a wealth of detail on rules
and process for ensuring information security, but very little in the way of
the means of, or requirements for, organizations to work together to fight the
good fight. And it has a major hole in its attempt to categorize threat
detection and response.

Here is the problem: The delay between a breach, developing
a defense and sharing the solution can take months, if not longer. Why the
delay? Because the good guys do not share enough information. The black hats
are aggressively sharing techniques and new approaches. Thus, we applaud
anything that the government can do to encourage exchange of information on cybersecurity
threats and new methods employed by hackers and other cyber-criminals.